Lecture 7 Flashcards
Malicious code
A threat that exploits various vulnerability to spread malicious payloads is called what?
Malicious code
People who are extremely skilled software developers and develop maliciuos code are called what?
A. Skilled malicious code programmers
B. Script kiddies
A. Skilled malicious code programmers
A person that uses existing and well known techniques and programs or scripts are called what?
A. Skilled malicious code programmers
B. Script kiddies
B. Script kiddies
Macro virus uses what?
script functionality
This virus is stored is stored in the MBR and another location in the system.
master boot record (MBR) virus
This virus type infects executable files and triggers when the OS tries to execute them.
File infector virus
Why are there fewer UNIX viruses?
they are developed on entirely different kernels make it difficult to write a virus that would impact a large number of UNIX systems
Signature based antivirus works how?
Use a database of known signatures to find a virus
A virus that uses more than 1 propagation technique is called what?
A. Stealth
B. Multipart
C. Hidden
D. Rootkit
B. Multipart
What type of virus hides by tampering with the OS?
A. Stealth
B. Multipart
C. Hidden
D. Polymorphic
A. Stealth
This virus modifies its code as it moves from system to system.
A. Stealth
B. Multipart
C. Polymorphic
D. Rootkit
C. Polymorphic
This virus encrypts their code with different cryptographic keys to avoid detection.
A. Stealth
B. Encrypted
C. Polymorphic
D. Rootkit
B. Encrypted
What is a logic bomb virus?
It lies dormant until a specific trigger is met..Can be time or a particular action being performed
What time of virus looks benign but is really malicious?
Trojan Horse
What is a worm?
Malicious code that can self propagate.
The code red worm did 3 things. What were they?
Look for vulnerable versions of IIS
Defaced html pages on the local web server
planted a logic bomb
This worm searched for a Siemans controller to disrupt nuclear facilities by destroying the centrifuge.
Stuxnet
This type of malicious code monitors your actions and collects information and transmits it back to a remote system.
Spyware
What are the three key places to implement countermeasures of malicious code?
Clients
Servers
Content filters (ex: email)
This type of DDos compromised third party systems to install a program and lies dormant waiting for instruction.
A. Syn Flood
B. Trinoo and Tribe Flood Network
C. Smurf
D. Teardrop
B. Trinoo and Tribe Flood Network
This attack uses one or more third party newtorks to conduct an attack.
A. Syn Flood
B. Trinoo and Tribe Flood Network
C. Smurf
D. Teardrop
C. Smurf (distributed reflective denial-of-service attack) (DRDos)
A DNS amplification attack is used to what?
Send a large volume of unwanted traffic to a third party.
this type of attack is where a fragmented packet is sent that does not conform to the fragmentation protocol specification. The system doesn’t know how to handle this and can crash.
Teardrop
This type of attack occurs when an artificial TCP segmnt has the SYN flag set and the source and destination IP are set to the victim machine.
Land attack
An attack where a ping packet is sent with a size over the alloted size (65,536).
Ping of Death
When a developer does not properly program input validation this attack can occur.
buffer overflow
When a program checks the access permission too far in advance of a resource use this issue can occur.
A. buffer overflow
B. Land attack
C. TOC/TOU
D. teardrop
C. TOC/TOU
An undocumted access mechanism to bypass normal access restrictions. Developers may use them.
trapdoor/backdoor
These are used to allow attackers to gain expanded access to a system.
Rootkit
this type of attack on web applications injects client-side scripts into webpages.
A. SQL injection
B. Cross-site Scripting (XSS)
B. Cross-site Scripting (XSS)
This occurs when an attacker inserts their own SQL code into the input field to affect the underlying database.
A. SQL injection
B. Cross-site Scripting (XSS)
A. SQL injection
A reconnaissance attack that tries to gather IP information about an organization. Can use ping sweep.
A. Port Scan
B. Vulnerability scan
C. Ip Probe
D. Dumpster Diving
C. Ip Probe
Performing a scan to find open or used ports in an environment.
A. Port Scan
B. Vulnerability scan
C. Ip Probe
D. Dumpster Diving
A. Port Scan
A tool to find specific vulnerabilities on a potential target system.
A. Port Scan
B. Vulnerability scan
C. Ip Probe
D. Dumpster Diving
B. Vulnerability scan
This attack analyzes waste to gain intelligence that might help launch an attack.
A. Port Scan
B. Vulnerability scan
C. Ip Probe
D. Dumpster Diving
D. Dumpster Diving
